Application of Attribute-Based Encryption in Military Internet of Things Environment
Abstract
:1. Introduction
- Enable authentication and authorization of IoT devices from various federation organizations
- Flexible data management enabling fine-grained access control to secure data flow from sources to different recipients.
- Guarantee the security and reliability of data acquisition, flexible processing, and distribution to potential recipients with resource-limited IoT devices.
- Decoupling organizations, i.e., ensuring that no organization can obtain identifying data and the key to communicating with another organization’s devices without its consent; also requires certain conditions defined in the federation’s security policy. No single organization forming a federation can control the entire system.
- Ensure immediate interoperability (zero-day interoperability), that is, readiness for deployment when the need arises for a federated IoT environment.
- Firstly, we built the framework for secure and reliable data dissemination in a federated MIoT environment, enabling IoT device authentication based on their identity (fingerprint), with the use of distributed registry technology (Hyperledger Fabric), a message broker (Apache Kafka), data processing microservices (using the Kafka Streams API library), and software IoT gateways providing the verification process.
- Secondly, through an appropriate ABE scheme, we introduced a data-centric security paradigm in the experimental MIoT framework that ensures secure data management from the source to the end user.
- Thirdly, we designed and implemented ABE cryptography data access control methods, using a combination of pairings-based elliptic curve cryptography and lightweight cryptography, and confirmed their suitability for a federated military IoT environment.
- Fourthly, we built an experimental setup, implemented an access control scheme designed on mobile components (RPi), and performed an evaluation of its performance.
2. Related Works
3. Military Internet of Things Environment
3.1. Environment Elements
3.2. System Requirements
- Each soldier is equipped with various health monitoring sensors, including but not limited to heartbeat sensors and thermometers.
- Each sensor is seamlessly connected (paired) to an edge computing device integrated into the soldier’s equipment. These edge devices can perform basic cryptographic operations to ensure data security and integrity.
- A network infrastructure facilitates the communication between sensors, actuators, and central data centers.
- Special services are responsible for processing incoming data from sensors, analyzing health metrics, and issuing commands to actuators as necessary.
- Real-time tracking of soldier locations using GPS.
- Monitoring of vital signs such as body temperature, heart rate, and oxygen levels.
- Use of wireless body area sensor networks (WBASNs) for data collection.
- Integration with IoT platforms for data transmission to command centers.
- Potential incorporation of machine learning for data analysis and prediction.
- End-to-end encryption: All communication channels between sensors, e.g., devices, and data centers must be encrypted with a security level sufficient for IoT purposes, ensuring that data are protected from unauthorized access or tampering throughout their transmission, safeguarding sensitive health information.
- Authentication and access control: Each device within the network must authenticate itself before participating in data exchange. Access control mechanisms should be enforced to restrict access based on roles and privileges, preventing unauthorized devices from accessing the network, while access control ensures that only authorized users or devices can interact with the system, reducing the risk of data breaches.
- Integrity verification: Data integrity checks should be implemented at each stage of data transmission to detect and prevent tampering or alteration of sensor data, through integrity verification mechanisms, such as cryptographic hash functions, ensuring that data remain unchanged during transit, maintaining their reliability and trustworthiness.
- Interoperability in federated environments: Interoperability within systems, whether military or civilian, is essential for enhancing effectiveness and responsiveness. For instance, it allows health monitoring systems deployed by military units to share real-time health data with civilian healthcare providers, enabling timely medical interventions and resource allocation during joint operations or disaster response efforts. This aspect also gains significance in joint military operations conducted in federated environments involving allied forces. Interoperability extends beyond technical integration to encompass the harmonization of processes, standards, and protocols.
- Data-centric security: With the proliferation of IoT devices and sensors worn by individuals, the volume and variety of health data generated have increased exponentially. Data-centric security focuses on protecting the data rather than solely relying on perimeter defenses, acknowledging that traditional security measures may be insufficient in dynamic and distributed environments. Encryption ensures that data remain unintelligible to unauthorized entities during transmission over the network, mitigating the risk of interception or eavesdropping. Access controls enforce granular permissions, allowing only authorized personnel/systems to access/manipulate health data, reducing the likelihood of data disclosure or breaches.
4. Attribute-Based Encryption
4.1. Bilinear Pairings
- Bilinearity: for all , and .
- Non-degeneracy: if g is a generator of .
- Computability: There exists an efficient algorithm to compute for all .
4.2. ABE Procedures
- Setup(): This procedure initializes the system.
- (a)
- Choose bilinear groups and of prime order p. These groups are fundamental to cryptographic operations.
- (b)
- Select a generator . This will be used to generate other group elements.
- (c)
- Choose random exponents . These serve as the core secrets of the system.
- (d)
- Compute the public parameters:
- : This hides while allowing its use in computations.
- : This is used in encryption and decryption.
- : This is a pairing operation that hides .
- (e)
- Set as the public parameters.
- (f)
- Set as the master secret key.
- (g)
- Output and . is made public, while is kept secret.
- KeyGen(, S): This procedure generates a secret key for an attribute set S.
- (a)
- Choose a random . This randomizes the key for security.
- (b)
- Compute . This embeds the master secret into the key.
- (c)
- For each attribute :
- Choose a random . This further randomizes each attribute component.
- Compute . is a hash function mapping attributes to group elements.
- Compute . This allows for cancellation in decryption.
- (d)
- Set as the secret key for attribute set S.
- (e)
- Output .
- Encrypt(, m, ): This procedure encrypts a message m under an access policy .
- (a)
- Choose a random . This randomizes the encryption.
- (b)
- Compute . This hides the message with the master secret.
- (c)
- Compute . This is used in decryption to recover the message.
- (d)
- For each attribute i in the access structure :
- Choose a random . This randomizes each attribute in the policy.
- Compute .
- Compute . This embeds the policy into the ciphertext.
- (e)
- Set as the ciphertext.
- (f)
- Output .
- Decrypt(, , ): This procedure attempts to decrypt a ciphertext using a secret key.
- (a)
- First, check if the attribute set S satisfies the access policy . If not, output ⊥ (decryption failure).
- (b)
- If S satisfies :
- Compute using and :
- This involves pairing operations and computations based on the satisfying set of attributes.
- The computation cancels out randomizing factors, leaving only .
- Recover the message: .
- Output the decrypted message m.
5. Data Exchange System
5.1. Experimental Environment Architecture
- The publishers layer represents authenticated and authorized entities (sensors and actuators) that produce and secure messages through the sealing process. The device’s fingerprint (identity) is the key used for the sealing process.
- The subscribers layer comprises authenticated and authorized entities that read available data from the Kafka cluster layer.
- The Kafka cluster layer is compromised of Apache Kafka message brokers that acquire, merge, store, and replicate data generated from the publishers layer (producers) and make it available to the subscribers layer (consumers). Apache Kafka operates on a producer–broker–consumer (publish–subscribe) model, facilitating the classification of messages based on their respective topics. The inherent synchronization mechanisms and distributed data replication among brokers ensure the continuous availability and reliability of data records. Furthermore, Kafka’s serialization and compression techniques (e.g., lz4, gzip) enable the system to remain agnostic to data formats and network protocols, thereby ensuring compatibility and robustness in heterogeneous environments.
- The Streams microservice layer is primarily utilized to verify sealed messages. Additionally, it can be used to analyze, group, and share messages related to relevant entities and enrich them (e.g., by detecting objects during image processing). The system leverages the built-in primitives of the Kafka cluster layer, such as failover and fault tolerance. Additionally, it employs a semantic guarantee pattern ensuring that each record (message) is processed exactly once end-to-end. Consequently, even in the event of a stream processor (microservice) failure, records are neither lost nor processed multiple times. In the proposed system, it is also utilized for ABE re-encryption.
- The device maintain layer manages (e.g., define, register, retire) device identity images stored in the distributed ledger. In the proposed system, it is also responsible for ABE attribute and device management.
- The communication layer enables the Streams microservice and the device maintain layer to communicate with the distributed ledger layer via a hardware–software IoT gateway. Moreover, a dynamic mode is proposed for the connection profile. This profile utilizes the ledger nodes’ built-in mechanism to continuously detect changes in network topology. Consequently, microservices will be able to operate reliably, even in the event of some node failures.
- The distributed ledger layer redundantly stores the identities of devices belonging to organizations participating in the federation. A permissioned blockchain that employs the Practical Byzantine Fault Tolerance (PBFT) consensus protocol is proposed. In protocols of this nature, all participants must be mutually known, necessitating the use of a public key infrastructure (certificates) for identity verification. The execution of complex business logic, such as device registry, is facilitated by invoking multilingual chaincode (Go, Java, Node.js). Chaincode implements a collection of smart contracts (transaction steps) and defines an endorsement policy, specifying which organizations must authorize a transaction.
5.2. Authorization Challenges
- Deployment of an external server that associates users with roles and/or groups (e.g., LDAP server);
- Definition of a detailed ACL by specifying permission type for group, role, and user (ACL stored in Kafka cluster layer);
- Integrating a custom implementation of authorizer with the user association server.
5.3. Attribute-Based Encryption Application
- Unbounded attribute sets and policies: The algorithms can handle attribute sets and policies of any size without predetermined limits.
- Support for negation and multi-use of attributes: This allows for more complex and expressive access control policies.
- Fast decryption: The schemes are designed to perform decryption operations quickly, enhancing overall system performance.
- Full security under standard assumptions: The algorithms provide strong security guarantees based on well-established cryptographic assumptions.
5.4. Design Proposition
5.4.1. General Overview
- Encrypted data segment: Encrypted with key derived from the device fingerprint; it consists of (1) encrypted message, (2) encrypted ABE policy, (3) unencrypted session GUID.
- Preamble: Used to authenticate message; it consists of (1) HMAC of encrypted data segment (with key derived from fingerprint), (2) device GUID, (3) session GUID.
5.4.2. Attribute-Based Encryption Message Flow
- The sensor generates data; for example, a smartphone equipped with a heart rate sensor detects an anomaly in heart activity. This information is appended with an attribute logic sentence and encrypted using the device fingerprint. Let the logic sentence be MEDICAL and GRID28B, where GRID28B represents the sector number obtained from the location sensor, also associated with this smartphone. GUIDs and HMAC are further appended as delineated in the system overview.
- The sensor sends the data to a Kafka input topic, where processing is executed as described in the system overview.
- Devices subscribed to the MEDICAL topic receive the message. If they satisfy the attached attribute logic sentence, they decrypt the message using their current keys at the time of data transmission. The Kafka microservice preliminarily verifies the authenticity of the message.
5.4.3. Attribute-Based Encryption System Setup
- Establishment of ABE system parameters, including the master secret key.
- Pairing data recipients possessing limited computational capabilities with more robust devices by sharing a common symmetric key for communication, treating them as a unified entity.
- Loading ABE system parameters onto the designated devices intended for system operation.
- Associate private keys with device identifiers on devices designated for data reception. An identifier is any piece of information used to uniquely distinguish a device, such as a device GUID generated in this step or a combination of type and number, e.g., UAV-1. These keys enable the distribution of attribute keys for specific devices when granting new permissions or authenticating attribute requests. This process is recorded in Hyperledger as device registration.
- Loading private keys corresponding to granted attributes onto the respective devices. This action is documented in Hyperledger as attribute granting.
5.4.4. Attribute and Device Revocation
- A specific attribute, such as MEDICAL, is granted to any number of devices, with each grant action recorded in Hyperledger.
- Upon revocation of the recipient attribute, this incident is documented in Hyperledger.
- New attributes associated with a revocation block number, e.g., UAV-123, are issued to all other devices. Distribution occurs by encrypting new private keys with each device’s identity and publishing them to the Kafka device management topic.
- The microservice responsible for ABE re-encryption employs the new attribute public key.
5.4.5. Granting New Permissions
- The recipient device sends a request to KGC, signing it with its identifier.
- In KGC, after signature verification, a decision is made to grant a new key. It is reported on Hyperledger and sent back to the device, signed by KGC, and encrypted with the recipient identifier.
- After signature verification and decryption, if an attribute is of a topic type, the device subscribes to the new topic in the Kafka broker.
5.5. Vertical Industry Usage
6. Experimental Results
6.1. Experiment Objective
- Encryption and decryption time using ABE: Evaluates the time required to encrypt and decrypt data using ABE.
- Latency in data transmission via Kafka and device verification in Hyperledger: Measures the delay associated with transmitting data through the Kafka stream broker and the subsequent retrieval and verification of data within the Hyperledger framework.
- Key generation time: Examines the time taken to generate new encryption keys when new keys are issued or existing keys are revoked.
- Size of the resulting ciphertexts: Assesses the size of the encrypted data produced through the ABE processing.
6.2. MIoT Context
6.3. Implementation
6.4. Performance Evaluation
6.5. PKI Comparison
7. Conclusions
Author Contributions
Funding
Institutional Review Board Statement
Data Availability Statement
Conflicts of Interest
Abbreviations
ACL | Access control list |
AES | Advanced Encryption Standard |
AWS | Amazon Web Services |
ABE | Attribute-based encryption |
ABAC | Attribute-based access control |
BLS12-381 | Barreto–Lynn–Scott 12-381 elliptic curve |
CP-ABE | Ciphertext-policy attribute-based encryption |
EC | Elliptic curve |
eMBB | Enhanced Mobile Broadband |
eMTC | Massive Machine-Type Communication |
ESP32 | Espressif Systems’ ESP32 microcontroller |
FMN | Federated Mission Networking |
FCS | Future Combat Systems |
GPU | Graphics processing unit |
GUID | Globally Unique Identifier |
HMAC | Keyed-hash message authentication code |
IoT | Internet of Things |
KP-ABE | Key-policy attribute-based encryption |
KPIs | Key performance indicators |
LDAP | Lightweight Directory Access Protocol |
LoRaWAN | Long Range Wide Area Network |
MDPI | Multidisciplinary Digital Publishing Institute |
MIoT | Military Internet of Things |
NATO | North Atlantic Treaty Organization |
PBFT | Practical Byzantine Fault Tolerance |
PDP | Policy decision point |
PEP | Policy enforcement point |
PKI | Public key infrastructure |
RSA | Rivest–Shamir–Adleman |
SASL | Simple Authentication and Security Layer |
SHA256 | Secure Hash Algorithm 256-bit |
TKN20 | Tomida–Kawahara–Nishimaki ABE scheme |
TLS | Transport Layer Security |
UAV | Unmanned aerial vehicle |
URLLC | Ultra-Reliable and Low-Latency Communication |
WBASN | Wireless body area sensor network |
References
- Abdelzaher, T.; Ayanian, N.; Başar, T.; Diggavi, S.; Diesner, J.; Ganesan, D.; Govindan, R.; Jha, S.; Lepoint, T.; Marlin, B.; et al. Will Distributed Computing Revolutionize Peace? Emerg. Battlef. IoT 2018, 7, 1129–1138. [Google Scholar] [CrossRef]
- Kanciak, K.; Jarosz, M.; Glebocki, P.; Wrona, K. Enabling civil-military information sharing in federated smart environments. In Proceedings of the 2021 IEEE 7th World Forum on Internet of Things (WF-IoT), New Orleans, LA, USA, 14 June–31 July 2021; pp. 897–902. [Google Scholar] [CrossRef]
- Pradhan, M.; Suri, N.; Zielinski, Z.; Tortonesi, M.; Fuchs, C.; Wrona, K.; Furtak, J.; Vasilache, D.; Street, M.; Pellegrini, V.; et al. Exploiting smart city IoT for disaster recovery operations. In Proceedings of the 2018 IEEE 4th World Forum on Internet of Things (WF-IoT), Singapore, 5–8 February 2018. [Google Scholar] [CrossRef]
- Sahai, A.; Waters, B. Fuzzy Identity-Based Encryption. In Proceedings of the Advances in Cryptology–EUROCRYPT 2005; Cramer, R., Ed.; Springer: Berlin/Heidelberg, Geramny, 2005; pp. 457–473. [Google Scholar]
- Johnsen, F.; Hauge, M. Interoperable, adaptable, information exchange in NATO coalition operations. J. Mil. Stud. 2022, 11, 49–62. [Google Scholar] [CrossRef]
- Jansen, N.; Manso, M.; Toth, A.; Chan, K.; Bloebaum, T.; Johnsen, F. NATO Core Services profiling for Hybrid Tactical Networks—Results and Recommendations. In Proceedings of the 2021 International Conference on Military Communication and Information Systems (ICMCIS), Hague, The Netherlands, 4–5 May 2021; pp. 1–8. [Google Scholar] [CrossRef]
- Suri, N.; Fronteddu, R.; Cramer, E.; Breedy, M.; Marcus, K.; Velt, R.; Nilsson, J.; Mantovani, M.; Campioni, L.; Poltronieri, F.; et al. Experimental Evaluation of Group Communications Protocols for Tactical Data Dissemination. In Proceedings of the MILCOM 2018—2018 IEEE Military Communications Conference (MILCOM), Los Angeles, CA, USA, 29–31 October 2018; pp. 133–139. [Google Scholar] [CrossRef]
- De Rango, F.; Potrino, G.; Tropea, M.; Fazio, P. Energy-aware dynamic Internet of Things security system based on Elliptic Curve Cryptography and Message Queue Telemetry Transport protocol for mitigating Replay attacks. Pervasive Mob. Comput. 2019, 61, 101105. [Google Scholar] [CrossRef]
- Yang, M.; Margheri, A.; Hu, R.; Sassone, V. Differentially Private Data Sharing in a Cloud Federation with Blockchain. IEEE Cloud Comput. 2017, 5, 69–79. [Google Scholar] [CrossRef]
- Wang, X.; Zha, X.; Ni, W.; Liu, R.P.; Guo, Y.J.; Niu, X.; Zheng, K. Survey on blockchain for Internet of Things. Comput. Commun. 2019, 136, 10–29. [Google Scholar] [CrossRef]
- Guo, S.; Wang, F.; Zhang, N.; Qi, F.; Xuesong, Q. Master-slave chain based trusted cross-domain authentication mechanism in IoT. J. Netw. Comput. Appl. 2020, 172, 102812. [Google Scholar] [CrossRef]
- Xu, L.; Chen, L.; Gao, Z.; Fan, X.; Suh, T.; Shi, W. DIoTA: Decentralized-Ledger-Based Framework for Data Authenticity Protection in IoT Systems. IEEE Netw. 2020, 34, 38–46. [Google Scholar] [CrossRef]
- Khalid, U.; Asim, M.; Baker, T.; Hung, P.; Tariq, M.A.; Rafferty, L. A decentralized lightweight blockchain-based authentication mechanism for IoT systems. Clust. Comput. 2020, 23, 2067–2087. [Google Scholar] [CrossRef]
- Al-Mekhlafi, Z.G.; Al-Shareeda, M.A.; Manickam, S.; Mohammed, B.A.; Qtaish, A. Lattice-Based Lightweight Quantum Resistant Scheme in 5G-Enabled Vehicular Networks. Mathematics 2023, 11, 399. [Google Scholar] [CrossRef]
- Mohammed, B.A.; Al-Shareeda, M.A.; Manickam, S.; Al-Mekhlafi, Z.G.; Alreshidi, A.; Alazmi, M.; Alshudukhi, J.S.; Alsaffar, M. FC-PA: Fog Computing-Based Pseudonym Authentication Scheme in 5G-Enabled Vehicular Networks. IEEE Access 2023, 11, 18571–18581. [Google Scholar] [CrossRef]
- Müller, S.; Katzenbeisser, S.; Eckert, C. Distributed Attribute-Based Encryption. In Proceedings of the Information Security and Cryptology—ICISC 2008; Lee, P.J., Cheon, J.H., Eds.; Springer: Berlin/Heidelberg, Germany, 2009; pp. 20–36. [Google Scholar]
- Jiang, J.; Gao, Y.; Gong, Y.; Jiang, Z. A Blockchain Copyright Protection Scheme Based on CP-ABE Scheme with Policy Update. Sensors 2024, 24, 4493. [Google Scholar] [CrossRef] [PubMed]
- Lu, Y.; Feng, T.; Liu, C.; Zhang, W. A Blockchain and CP-ABE Based Access Control Scheme with Fine-Grained Revocation of Attributes in Cloud Health. Comput. Mater. Contin. 2024, 78, 2787–2811. [Google Scholar] [CrossRef]
- Gondalia, A.; Dixit, D.; Parashar, S.; Raghava, V.; Sengupta, A.; Sarobin, V. IoT-based Healthcare Monitoring System for War Soldiers using Machine Learning. Procedia Comput. Sci. 2018, 133, 1005–1013. [Google Scholar] [CrossRef]
- V, S.; R, S.; B, A.; V, V.S.; Vigneswari, P. IoT based Healthcare Monitoring and Tracking System for Soldiers using ESP32. In Proceedings of the 2022 6th International Conference on Computing Methodologies and Communication (ICCMC), Erode, India, 29–31 March 2022; pp. 377–381. [Google Scholar] [CrossRef]
- Hu, V.C.; Ferraiolo, D.; Kuhn, D.; Schnitzer, A.; Sandlin, K.; Miller, R.; Scarfone, K. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Spec. Publ. 2019, 800, 1–54. [Google Scholar] [CrossRef]
- Song, H.; Tu, Z.; Qin, Y. Blockchain-Based Access Control and Behavior Regulation System for IoT. Sensors 2022, 22, 8339. [Google Scholar] [CrossRef] [PubMed]
- Wrona, K. Securing the Internet of Things a military perspective. In Proceedings of the 2015 IEEE 2nd World Forum on Internet of Things (WF-IoT), Milan, Italy, 14–16 December 2015; pp. 502–507. [Google Scholar] [CrossRef]
- Sueur, P.L. The Felin soldier system: A tailored solution for networked operations. In Proceedings of the SPIE Defense + Commercial Sensing, Orlando, FL, USA, 9–13 April 2007. [Google Scholar]
- Dietterle, R. The future combat systems (FCS) overview. In Proceedings of the MILCOM 2005—2005 IEEE Military Communications Conference, Atlantic City, NJ, USA, 17–20 October 2005; Volume 5, pp. 3269–3273. [Google Scholar] [CrossRef]
- Product Manager Ground Soldier Systems. Nett Warrior Interconnect Architecture White Paper. 2017. Available online: https://imlive.s3.amazonaws.com/Federal%20Government/ID290146323786724032196446312686336282340/Attachment_E_-_NW_Interconnect_Architecture.pdf (accessed on 19 July 2024).
- Kanciak, K.; Wrona, K.; Jarosz, M. Secure Onboarding and Key Management in Federated IoT Environments. In Proceedings of the 17th Conference on Computer Science and Intelligence Systems, Sofia, Bulgaria, 4–7 September 2022; pp. 627–634. [Google Scholar] [CrossRef]
- Sychowiec, J.; Zielinski, Z. An Experimental Framework for Secure and Reliable Data Streams Distribution in Federated IoT Environments. In Proceedings of the 18th Conference on Computer Science and Intelligence Systems, Warsaw, Poland, 17–20 September 2023; pp. 769–780. [Google Scholar] [CrossRef]
- Belguith, S.; Kaaniche, N.; Hammoudeh, M. Analysis of attribute based cryptographic techniques and their application to protect cloud services. Trans. Emerg. Telecommun. Technol. 2022, 33, e3667. [Google Scholar] [CrossRef]
- Tomida, J.; Kawahara, Y.; Nishimaki, R. Fast, Compact, and Expressive Attribute-Based Encryption. Cryptology ePrint Archive, Paper 2019/966. 2019. Available online: https://eprint.iacr.org/2019/966 (accessed on 19 July 2024).
- Susan Symington, W.; Polk, M.S. Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management; US Department of Commerce: Washington, DC, USA, 2020. [Google Scholar]
- Praveen, G.; Chamola, V.; Hassija, V.; Kumar, N. Blockchain for 5G: A Prelude to Future Telecommunication. IEEE Netw. 2020, 34, 106–113. [Google Scholar] [CrossRef]
- Salahdine, F.; Liu, Q.; Han, T. Towards Secure and Intelligent Network Slicing for 5G Networks. IEEE Open J. Comput. Soc. 2022, 3, 23–38. [Google Scholar] [CrossRef]
- Article Code Repository. Available online: https://github.com/mojitax/Application-of-Attribute-Based-Encryption-in-Military-Internet-of-Things-Environment (accessed on 19 July 2024).
- CIRCL Github Repository. Available online: https://github.com/cloudflare/circl (accessed on 14 April 2024).
- Barreto, P.; Lynn, B.; Scott, M. Constructing Elliptic Curves with Prescribed Embedding Degrees. Lect. Notes Comput. Sci. 2002, 2576, 257–267. [Google Scholar] [CrossRef]
- BLS12-381 Curve Description. Available online: https://electriccoin.co/blog/new-snark-curve/ (accessed on 17 April 2024).
- Guillevic, A.; Masson, S.; Thomé, E. Cocks–Pinch curves of embedding degrees five to eight and optimal ate pairing computation. Des. Codes Cryptogr. 2020, 88, 1047–1081. [Google Scholar] [CrossRef]
- Boulogeorgos, A.A.A.; Bouzouita, M.; Ksentini, A.; Fossorier, M. Analysis of Web-Based IoT through Heterogeneous Networks. Sensors 2022, 22, 664. [Google Scholar] [CrossRef] [PubMed]
Abe Encrypt | Abe Decrypt | ||||||||
---|---|---|---|---|---|---|---|---|---|
Message Length [bytes] | Number of Attributes | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev |
32 | 1 | 35.88 ms | 35.85 ms | 35.70 ms | 0.5 ms | 15.27 ms | 15.35 ms | 15.42 ms | 0.3 ms |
32 | 2 | 43.50 ms | 43.40 ms | 43.80 ms | 0.5 ms | 18.49 ms | 18.12 ms | 17.87 ms | 0.3 ms |
32 | 3 | 46.78 ms | 46.64 ms | 46.27 ms | 0.7 ms | 15.49 ms | 15.57 ms | 15.63 ms | 0.3 ms |
32 | 5 | 73.70 ms | 73.34 ms | 72.91 ms | 0.8 ms | 20.42 ms | 20.20 ms | 20.26 ms | 0.4 ms |
32 | 8 | 83.43 ms | 83.72 ms | 83.20 ms | 0.9 ms | 21.25 ms | 21.29 ms | 21.38 ms | 0.4 ms |
Message Length [bytes] | Number of Attributes | Ciphertext Length [bytes] |
---|---|---|
32 | 1 | 2384 |
32 | 2 | 2744 |
32 | 3 | 3093 |
32 | 5 | 4567 |
32 | 8 | 4858 |
Abe Encrypt | Abe Decrypt | ||||||||
---|---|---|---|---|---|---|---|---|---|
Message Length [bytes] | Number of Attributes | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev |
32 | 1 | 736.44 ms | 736.41 ms | 736.34 ms | 14.1 ms | 281.45 ms | 281.47 ms | 281.58 ms | 7.2 ms |
32 | 2 | 905.95 ms | 906.01 ms | 906.05 ms | 14.7 ms | 291.47 ms | 291.42 ms | 291.37 ms | 7.7 ms |
32 | 3 | 1.0780 s | 1.0791 s | 1.0786 s | 15.2 ms | 301.55 ms | 301.57 ms | 301.52 ms | 8.1 ms |
32 | 5 | 1.4257 s | 1.4246 s | 1.4251 s | 16.3 ms | 321.41 ms | 321.49 ms | 321.44 ms | 8.3 ms |
32 | 8 | 1.9390 s | 1.9387 s | 1.9393 s | 26.2 ms | 351.69 ms | 351.75 ms | 351.73 ms | 8.9 ms |
Abe Encrypt | Abe Decrypt | ||||||||
---|---|---|---|---|---|---|---|---|---|
Message Length [bytes] | Number of Attributes | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev | Percentile 0.9 | Percentile 0.95 | Percentile 0.99 | Std Dev |
32 | 1 | 444.75 ms | 443.71 ms | 443.14 ms | 11.2 ms | 201.76 ms | 201.76 ms | 201.74 ms | 6.4 ms |
32 | 2 | 550.68 ms | 550.11 ms | 549.76 ms | 11.6 ms | 213.71 ms | 213.74 ms | 213.73 ms | 6.5 ms |
32 | 3 | 657.90 ms | 657.52 ms | 656.59 ms | 13.1 ms | 226.44 ms | 226.43 ms | 226.42 ms | 7.2 ms |
32 | 5 | 862.46 s | 861.99 ms | 862.10 ms | 14.7 ms | 250.35 ms | 250.35 ms | 250.34 ms | 7.3 ms |
32 | 8 | 1.1826 s | 1.1817 s | 1.1814 s | 17.2 ms | 287.00 ms | 287.00 ms | 286.99 ms | 8.0 ms |
Number of Attributes | Kafka and HL Processing—Avg Time | ABE Encrypt— Avg Time | Kafka and ABE Encrypt—Avg Time | ABE Decrypt— Avg Time | Kafka and ABE Encrypt and Decrypt— Avg Time | ||
---|---|---|---|---|---|---|---|
(a) | (a) | (b) | (a) | (b) | |||
1 | 48.6 ms | 35.70 ms | 84.30 ms | 15.35 ms | 281.58 ms | 99.65 ms | 365.88 ms |
2 | 48.6 ms | 43.80 ms | 92.4 ms | 18.12 ms | 291.37 ms | 110.52 ms | 383.77 ms |
3 | 48.6 ms | 46.27 ms | 94.87 ms | 15.57 ms | 301.52 ms | 110.44 ms | 396.39 ms |
5 | 48.6 ms | 72.91 ms | 121.51 ms | 20.20 ms | 321.44 ms | 141.71 ms | 442.95 ms |
8 | 48.6 ms | 83.20 ms | 131.8 ms | 21.29 ms | 351.73 ms | 153.09 ms | 483.53 ms |
Number of Attributes | Kafka and HL Processing—Avg Time | ABE Encrypt— Avg Time | Kafka and ABE Encrypt—Avg Time | ABE Decrypt— Avg Time | Kafka and ABE Encrypt and Decrypt— Avg Time | ||
---|---|---|---|---|---|---|---|
(a) | (a) | (b) | (a) | (b) | |||
1 | 48.6 ms | 35.70 ms | 84.30 ms | 15.35 ms | 201.89 ms | 99.65 ms | 286.19 ms |
2 | 48.6 ms | 43.80 ms | 92.4 ms | 18.12 ms | 213.84 ms | 110.52 ms | 306.24 ms |
3 | 48.6 ms | 46.27 ms | 94.87 ms | 15.57 ms | 226.58 ms | 110.44 ms | 321.45 ms |
5 | 48.6 ms | 72.91 ms | 121.51 ms | 20.20 ms | 250.48 ms | 141.71 ms | 371.99 ms |
8 | 48.6 ms | 83.20 ms | 131.8 ms | 21.29 ms | 287.15 ms | 153.09 ms | 418.95 ms |
Number of Attributes | Intel i5-13600KF | Raspberry Pi 5 |
---|---|---|
5 | 0.422 s | 1.914 s |
10 | 0.795 s | 2.895 s |
15 | 1.371 s | 3.904 s |
20 | 1.928 s | 4.884 s |
Algorithm | KeyGen | Encrypt | Decrypt | Enc + Dec | ||||
---|---|---|---|---|---|---|---|---|
Mean | St. Dev. | Mean | St. Dev. | Mean | St. Dev. | Mean | St. Dev. | |
RSA 2048 | 84 ms | 46 ms | 0.018 ms | 0.005 ms | 0.5 ms | 0.06 ms | 0.5 ms | 0.7 ms |
RSA 3072 | 298 ms | 145 ms | 0.096 ms | 0.021 ms | 1.5 ms | 0.08 ms | 1.6 ms | 0.1 ms |
RSA 4096 | 927 ms | 317 ms | 0.164 ms | 0.030 ms | 3.5 ms | 0.3 ms | 3.7 ms | 0.3 ms |
TKN20 Short | 28 ms | 1 ms | 26 ms | 0.5 ms | 9.7 ms | 0.6 ms | 36 ms | 1.1 ms |
TKN20 Long | 72 ms | 2 ms | 41 ms | 0.5 ms | 7.5 ms | 0.3 ms | 49 ms | 0.8 ms |
Algorithm | Ciphertext Size |
---|---|
RSA3072 | 489 |
TKN20 Short | 4105 |
TKN20 Long | 4779 |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Pióro, Ł.; Sychowiec, J.; Kanciak, K.; Zieliński, Z. Application of Attribute-Based Encryption in Military Internet of Things Environment. Sensors 2024, 24, 5863. https://doi.org/10.3390/s24185863
Pióro Ł, Sychowiec J, Kanciak K, Zieliński Z. Application of Attribute-Based Encryption in Military Internet of Things Environment. Sensors. 2024; 24(18):5863. https://doi.org/10.3390/s24185863
Chicago/Turabian StylePióro, Łukasz, Jakub Sychowiec, Krzysztof Kanciak, and Zbigniew Zieliński. 2024. "Application of Attribute-Based Encryption in Military Internet of Things Environment" Sensors 24, no. 18: 5863. https://doi.org/10.3390/s24185863